Personal Access Tokens
A personal access token stands in for your password where a browser sign-in is not possible: git over HTTPS, the APIGit CLI in CI, and tools that call the API. A token can do what you can do, within its kind.
Create a token
- Open Settings › Personal Access Token.
- Click Generate New Token, choose a kind and give the token a name.
- Copy the token. It is shown once.
| Kind | Use it for | Allows |
|---|---|---|
| Git and repository API | Cloning and pushing over HTTPS, the repository API | Repositories, including publishing documents and mock servers |
| CLI and automation | The apigit CLI, CI jobs, an MCP client that sends a header | The same, and reading your plan and your organizations with their governance rules |
The list shows what each token allows. Delete a token there when it is no longer needed or may have leaked; it stops working at once.
Tokens you did not type
apigit auth loginin a terminal shows a short code and opens a page where you confirm it. The token the CLI receives appears in the same list, and deleting it signs the CLI out.- A GitHub Actions job can sign in without a stored token. Its login lasts one hour and is limited to one repository.
Authorized applications
Applications you approved on a sign-in page, such as a chat application connected to the APIGit MCP server, are listed under Authorized applications on the same page, with what each may do. Revoke ends an application’s access at once.
Last updated on